How to discover hidden SSIDs ? I know there are tool like WiGLE WiFi (Mobile) which can identify hidden SSID. How those tools are exactly working. How it is discovering hidden SSID WiFi beacons ?
asked Jan 12, 2017 at 22:52
Add a comment
|
2 Answers
Basically you just need to force a user on that network to disassociate with the wifi, then when it reconnects, the ssid will be transmitted in plain text.
Check out this guide.
-
1Deauth attacks will not work all the time, but this is the right way to probe SSIDs.– user28177Jan 13, 2017 at 9:49
The baics of wifi (802.11 IEEE standard) states that there are 3 connection stages.
- Not authenticated or associated
- Authenticated but not yet associated
- Authenticated and associated
To move from the 1st stage to the 2nd, the STA (Station, any device/supplicant) sends a probe request with an SSID that is has saved in it's lists of already connected wireless networks, it is this exact packet that we want to capture.
To find a network name of a hidden ssid you need to send a STA from the 3rd stage of connection to the very first, to capture the probe request and read the SSID it's trying to connect.
This is done sending a disassociation management package to the AP spoofing the STA, and then sniffing the probe request when it wants to connect again.
